@tollerud/ui 4.0.2 → 4.0.4

package/AGENTS.md

@@ -39,12 +39,12 @@ npm install @tollerud/footer
 ```css
 /* app/globals.css */
 @import "@tollerud/ui/globals.css";
-@source "../node_modules/@tollerud/ui/dist";
+@import "@tollerud/ui/source.css";
 ```
 
-Adjust `@source` relative to your CSS file. Without it, classes used only inside `@tollerud/ui` dist may be purged.
+`source.css` resolves `@source` inside the installed package (npm, pnpm, workspaces, Bun). Without it, classes used only inside `@tollerud/ui` dist may be purged.
 
-**Optional preset shim** — extra utilities from `tollerud-preset.js`:
+**Optional preset shim** — extra utilities from `@tollerud/ui/preset`:
 
 ```ts
 // tailwind.config.ts

package/CHANGELOG.md

@@ -7,6 +7,59 @@
      • Never write bold mid-paragraph as a heading substitute — it merges into surrounding text
 -->
 
+## 4.0.4 — 2026-06-10 — Export verification and source.css
+
+Patch release: verifies all subpath exports in CI, adds package-owned Tailwind scanning, and expands install docs.
+
+### Added
+
+- `@tollerud/ui/source.css` — package-owned `@source` for `dist` scanning (npm, pnpm, workspaces, Bun)
+- `test:subpath` now checks all 70 manifest entries (`dist/{name}.js` + `.d.ts`)
+- `test:package` runs attw against every public subpath export
+
+### Changed
+
+- Recommended Tailwind v4 setup: `@import "@tollerud/ui/source.css"` after `globals.css`
+- `GETTING_STARTED.md` — monorepo `@source` path table, footer-only minimal install
+- `tailwind.css` re-exports `source.css` for one-import convenience
+- Docs site getting-started page updated for `source.css`
+
+### Migration
+
+Replace manual `@source "../node_modules/@tollerud/ui/dist"` with:
+
+```css
+@import "@tollerud/ui/globals.css";
+@import "@tollerud/ui/source.css";
+```
+
+---
+
+## 4.0.3 — 2026-06-09 — Publish pipeline hardening
+
+Patch release: aligns npm publish with `validate`, fixes preset export shape, enables provenance via OIDC, and fixes `@tollerud/footer` CI build.
+
+### Changed
+
+- `prepublishOnly` and `publish-npm.yml` now run `verify:footer-sync` and `test:consumer` before publish
+- `publish-npm.yml` auto-builds and publishes `@tollerud/footer` alongside `@tollerud/ui`
+- `tollerud-preset.js` renamed to `tollerud-preset.cjs` — fixes publint CJS-in-ESM warning; import via `@tollerud/ui/preset`
+- `@tollerud/ui/utils` subpath no longer ships `'use client'` — `cn` is safe to import from Server Components
+- Removed `engines.node` from `package.json` (contributor Node/npm guidance stays in `CONTRIBUTING.md`)
+- Publish uses npm Trusted Publishers (OIDC) with `--provenance` instead of `NPM_TOKEN`
+- `@tollerud/footer` ships its own `tsup.config.ts` — stops inheriting root TS 6 `tsconfig.build.json` during DTS emit
+
+### Docs
+
+- `README.md`, `GETTING_STARTED.md`, `SKILL.md`, `AGENTS.md` — preset import path updated
+- Added `NPM_PACKAGE_PLAN.md` — npm hardening audit and task list
+
+### Migration
+
+Nothing breaking. If you copied `tollerud-preset.js` locally, rename to `tollerud-preset.cjs` or switch to `import preset from '@tollerud/ui/preset'`.
+
+---
+
 ## 4.0.2 — 2026-06-10 — Repo layout and publish surface cleanup
 
 Patch release: consolidates docs and CI fixtures, stops shipping internal manifests, and clarifies docs copy after the npm-only pivot.

package/GETTING_STARTED.md

@@ -2,6 +2,10 @@
 
 ## Install
 
+### Full design system
+
+Copy-paste — installs `@tollerud/ui` and all required peers:
+
 ```bash
 npm install @tollerud/ui clsx tailwind-merge tailwindcss@4 \
   @radix-ui/react-dialog @radix-ui/react-dropdown-menu @radix-ui/react-progress \
@@ -17,19 +21,56 @@ As of **v2.0.0**, Radix, Lucide, Framer Motion, and Sonner are **required peer d
 npm install @paper-design/shaders-react
 ```
 
+### Footer only (minimal)
+
+If you only need the branded footer — no Tailwind, Radix, or other design-system peers:
+
+```bash
+npm install @tollerud/footer
+```
+
+```tsx
+import { Footer } from '@tollerud/footer'
+
+<Footer />
+```
+
+`@tollerud/footer` bundles `clsx` and `tailwind-merge` as dependencies. Use `@tollerud/ui` when you need the full component set.
+
 ---
 
 ## Tailwind Setup (v4)
 
+**Recommended** — package-owned `@source` (works with npm, pnpm, Yarn workspaces, and Bun):
+
 ```css
 /* app/globals.css */
 @import "@tollerud/ui/globals.css";
+@import "@tollerud/ui/source.css";
+```
+
+`globals.css` bundles Tailwind v4, design tokens, and all component layer styles. `source.css` points Tailwind at the installed package `dist` folder so component utility classes are not purged — no fragile `../node_modules` paths.
+
+### Manual `@source` path (monorepos / custom layouts)
+
+If you prefer an explicit path, resolve it **relative to your CSS file** to `node_modules/@tollerud/ui/dist`:
+
+| Layout | Example CSS file | `@source` path |
+|--------|------------------|----------------|
+| Next.js App Router (default) | `app/globals.css` | `../node_modules/@tollerud/ui/dist` |
+| `src/` app dir | `src/app/globals.css` | `../../node_modules/@tollerud/ui/dist` |
+| Turborepo / npm workspace app | `apps/web/app/globals.css` | `../../../node_modules/@tollerud/ui/dist` |
+| pnpm (package in workspace) | `app/globals.css` | Prefer `@import "@tollerud/ui/source.css"` — hoisting varies |
+| Bun | `app/globals.css` | Prefer `@import "@tollerud/ui/source.css"` |
+
+```css
+@import "@tollerud/ui/globals.css";
 @source "../node_modules/@tollerud/ui/dist";
 ```
 
-`globals.css` bundles Tailwind v4, design tokens, and all component layer styles. Point `@source` at the package `dist` folder relative to your CSS file so component utility classes are not purged.
+If styles disappear in production, the `@source` path is wrong — switch to `@tollerud/ui/source.css` or fix the relative path.
 
-**Optional preset shim** — for extra theme tokens from `tollerud-preset.js`:
+**Optional preset shim** — for extra theme tokens from `@tollerud/ui/preset` (`tollerud-preset.cjs`):
 
 ```ts
 // tailwind.config.ts
@@ -42,7 +83,7 @@ export default { presets: [tollerudPreset] }
 @config "./tailwind.config.ts";
 @import "@tollerud/ui/tokens.css";
 @import "@tollerud/ui/globals-layers.css";
-@source "../node_modules/@tollerud/ui/dist";
+@import "@tollerud/ui/source.css";
 ```
 
 ### Tailwind v3 (legacy)

package/README.md

@@ -42,16 +42,16 @@ As of **v2.0.0**, Radix primitives, Lucide, Framer Motion, and Sonner are **peer
 npm install @paper-design/shaders-react
 ```
 
-**CSS** — one import in `app/globals.css` (Tailwind v4 + tokens + component classes):
+**CSS** — two imports in `app/globals.css` (Tailwind v4 + tokens + component class scanning):
 
 ```css
 @import '@tollerud/ui/globals.css';
-@source '../node_modules/@tollerud/ui/dist';
+@import '@tollerud/ui/source.css';
 ```
 
-Adjust the `@source` path relative to your CSS file so it resolves to `node_modules/@tollerud/ui/dist`.
+`source.css` resolves `@source` inside the installed package — works with npm, pnpm, Yarn workspaces, and Bun. See [GETTING_STARTED.md](GETTING_STARTED.md) for manual `@source` paths in monorepos.
 
-**Optional preset shim** — if you need utilities from `tollerud-preset.js` beyond what `tokens.css` provides:
+**Optional preset shim** — if you need utilities from `@tollerud/ui/preset` beyond what `tokens.css` provides:
 
 ```ts
 // tailwind.config.ts
@@ -64,7 +64,7 @@ export default { presets: [tollerudPreset] }
 @config './tailwind.config.ts';
 @import '@tollerud/ui/tokens.css';
 @import '@tollerud/ui/globals-layers.css';
-@source '../node_modules/@tollerud/ui/dist';
+@import '@tollerud/ui/source.css';
 ```
 
 **Tailwind v3 (legacy)** — preset in `tailwind.config.ts` plus `@tollerud/ui/globals-v3.css`:
@@ -97,13 +97,13 @@ import { Button, Card, Badge, StatusDot, CodeBlock, Kbd, CommandMenu, NoirGlowBa
 
 TypeScript types are included — no `@types/*` package needed. See **[COMPONENTS.md](COMPONENTS.md)** for the full prop reference for every component.
 
-Publish a new version by bumping `version` in `package.json` and pushing to `main` — the `publish-npm` GitHub Action detects the version change, runs `npm publish` (using the `NPM_TOKEN` secret), and then creates a matching GitHub Release automatically.
+Publish a new version by bumping `version` in `package.json` and pushing to `main` — the `publish-npm` GitHub Action detects the version change, runs `npm publish --provenance` via npm Trusted Publishers (OIDC), and then creates a matching GitHub Release automatically.
 
 ### Copy from repo (alternative)
 
 ```bash
 npm install clsx tailwind-merge
-cp tollerud-preset.js globals.css components/ -r <your-next-project>/
+cp tollerud-preset.cjs globals.css components/ -r <your-next-project>/
 ```
 
 Then use local paths instead of `@tollerud/ui` in the snippets above.
@@ -235,7 +235,7 @@ design-system/
 ├── globals-v3.css            # Tailwind v3 legacy
 ├── globals-layers.css        # Shared component CSS layers
 ├── tokens.css                # Design tokens
-├── tollerud-preset.js        # Tailwind preset
+├── tollerud-preset.cjs       # Tailwind preset (CJS)
 ├── scripts/                  # Build, validate, docs, and release helpers
 ├── docs-app/                 # Next.js docs site (static export → _site/)
 │   ├── app/                  # App Router + globals.css

package/SKILL.md

@@ -22,12 +22,12 @@ npm install @paper-design/shaders-react
 
 As of **v4.0.1**, install is **npm-only** — `import { Button } from '@tollerud/ui'` or subpaths like `@tollerud/ui/button`. Copy-via-shadcn registry CLI is unsupported. As of **v4.0.0**, `@tollerud/ui/globals-v4.css` is removed — use `globals.css` only. Brand assets live at `@tollerud/ui/brand/*`. As of **v3.1.1**, `.tollerud-display-shimmer` ships in `globals.css` for animated hero accent text. As of **v3.1.0**, `Monogram` ships as an inline SVG component (`color`: `yellow` | `black` | `white`). As of **v3.0.0**, the package is **ESM-only** (no CJS `require` entry). As of **v2.0.0**, Radix, Lucide, Framer Motion, and Sonner are **required peers** (not bundled).
 
-Apply the Tailwind preset when you need extra utilities from `tollerud-preset.js` — `globals.css` already includes tokens and component layers for v4:
+Apply the Tailwind preset when you need extra utilities from `@tollerud/ui/preset` — `globals.css` already includes tokens and component layers for v4:
 
 ```css
 /* app/globals.css — Tailwind v4 (default) */
 @import "@tollerud/ui/globals.css";
-@source "../node_modules/@tollerud/ui/dist";
+@import "@tollerud/ui/source.css";
 ```
 
 As of **v1.4.0**, charts (`BarChart`, `AreaChart`, `Donut`, `Sparkline`) and marketing blocks (`HeroBlock`, `FeatureCard`, `CTABand`) ship in the package. As of **v1.3.0**, `@tollerud/ui/globals.css` is the Tailwind v4 entry. Tailwind colors are under `tollerud.*` only (`text-tollerud-yellow`, `bg-tollerud-surface-raised`, etc.) — not `tia-*`.

package/dist/utils.js

@@ -1,4 +1,3 @@
-'use client';
 export { cn } from './chunk-WSQNPRGN.js';
 //# sourceMappingURL=utils.js.map
 //# sourceMappingURL=utils.js.map

package/globals.css

@@ -4,9 +4,9 @@
    Usage in app/globals.css:
 
      @import '@tollerud/ui/globals.css';
-     @source '../node_modules/@tollerud/ui/dist';
+     @import '@tollerud/ui/source.css';
 
-   Optional preset shim (extra theme tokens from tollerud-preset.js):
+   Optional preset shim (extra theme tokens from tollerud-preset.cjs):
 
      @import 'tailwindcss';
      @config './tailwind.config.ts';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollerud/ui",
-  "version": "4.0.2",
+  "version": "4.0.4",
   "description": "Tollerud User Interface — dark, monochrome + yellow accent. Noir aesthetic meets modern utility.",
   "private": false,
   "type": "module",
@@ -13,11 +13,8 @@
     "url": "https://github.com/Tollerud/ui/issues"
   },
   "license": "MIT",
-  "author": "Mathias Tollerud <mathias.tollerud@gmail.com>",
+  "author": "Mathias Tollerud <mathias@tollerud.no>",
   "packageManager": "npm@11.16.0",
-  "engines": {
-    "node": ">=20"
-  },
   "sideEffects": [
     "*.css"
   ],
@@ -35,8 +32,9 @@
     "./globals-v3.css": "./globals-v3.css",
     "./globals-layers.css": "./globals-layers.css",
     "./tailwind.css": "./tailwind.css",
+    "./source.css": "./source.css",
     "./tokens.css": "./tokens.css",
-    "./preset": "./tollerud-preset.js",
+    "./preset": "./tollerud-preset.cjs",
     "./brand/tollerud-logo.svg": "./brand/tollerud-logo.svg",
     "./brand/tollerud-avatar.svg": "./brand/tollerud-avatar.svg",
     "./brand/tollerud-avatar.png": "./brand/tollerud-avatar.png",
@@ -55,8 +53,9 @@
     "globals-v3.css",
     "globals-layers.css",
     "tailwind.css",
+    "source.css",
     "tokens.css",
-    "tollerud-preset.js",
+    "tollerud-preset.cjs",
     "GETTING_STARTED.md",
     "COMPONENTS.md",
     "CHANGELOG.md",
@@ -86,7 +85,7 @@
     "docs:props": "node scripts/generate-props.mjs",
     "test:props": "node scripts/verify-props-drift.mjs",
     "validate": "npm run typecheck && npm run lint && npm run test && npm run build && npm run test:subpath && npm run test:drift && npm run test:package && npm run test:size && npm run test:props && npm run verify:footer-sync && npm run build:docs && npm run test:consumer",
-    "prepublishOnly": "npm run sync:registry && npm run typecheck && npm run lint && npm run test && npm run build && npm run test:subpath && npm run test:drift && npm run test:package && npm run test:size && npm run test:props",
+    "prepublishOnly": "npm run sync:registry && npm run typecheck && npm run lint && npm run test && npm run build && npm run test:subpath && npm run test:drift && npm run test:package && npm run test:size && npm run test:props && npm run verify:footer-sync && npm run test:consumer",
     "build:docs": "node scripts/build-docs.mjs",
     "preview:docs": "npx --yes serve _site -l 4173"
   },

package/source.css

@@ -0,0 +1,12 @@
+/**
+ * Tailwind v4 — scan @tollerud/ui dist for component utility classes.
+ *
+ * Import in app/globals.css after globals.css:
+ *
+ *   @import "@tollerud/ui/globals.css";
+ *   @import "@tollerud/ui/source.css";
+ *
+ * Paths resolve inside the installed package — works with npm, pnpm, Yarn
+ * workspaces, and Bun without fragile ../node_modules relative paths.
+ */
+@source "./dist";

package/tailwind.css

@@ -1,9 +1,6 @@
 /**
  * Convenience entry for Tailwind v4 consumers.
- * Re-exports globals + documents the @source path for class scanning.
+ * Re-exports globals + source scanning in one import.
  */
 @import "./globals.css";
-
-/* In your app globals.css, add after this import:
-@source "../node_modules/@tollerud/ui/dist";
-*/
+@import "./source.css";

package/{tollerud-preset.js → tollerud-preset.cjs}

@@ -4,7 +4,7 @@
   * Drop this into any Tailwind project:
   *
   *   // tailwind.config.ts
-  *   import tollerudPreset from './path/to/tollerud-preset'
+  *   import tollerudPreset from '@tollerud/ui/preset'
  *   export default {
  *     presets: [tollerudPreset],
  *     content: ['your-source-files'],